chore(deps): audit and update dependencies, raise security override floors, collapse duplicate versions

[waleedlatif1]

Summary

• Bump same-major deps to the newest release that clears the 7-day minimumReleaseAge gate: AWS SDK 3.1150, Radix, openai 7.32, @google/genai 2.28, drizzle-orm 0.45.4, mongodb/mysql2/mssql patches, socket.io 4.8.4, yjs/lib0, xyflow 12.12, nuqs 2.10, posthog-js, react-hook-form, c15t 2.3, knip 6.41, vitest 5.0.4, @types/node 24.19, and more
• Take majors whose breaking changes don't reach our call sites (verified against the dist/.d.ts diffs): @1password/sdk 0.5, @linear/sdk 97, groq-sdk 1.6, twilio 6, svix 2, resend 6, diff 9, @octokit/rest 22
• Raise security override floors that now have advisories against their pinned versions: brace-expansion 5.0.12, engine.io 6.6.11, fast-uri 3.1.8, ip-address 10.7.4, hono 4.13.13, dompurify 3.4.17
• Fix two overrides: minimatch was pinned below what pi-coding-agent requires (10.2.6); postgres caret range would silently drop patches/postgres@3.4.9.patch on the next lockfile refresh (now exact 3.4.9)
• Collapse duplicate copies: emcn devDeps mirror the app's exact Radix/input-otp/cva pins so emcn stops resolving its own nested react-avatar/react-slot; single ajv, typebox (same TSchema identity pi validates with), jose (matches better-auth/MCP/a2a exact pins); resend 6 drops the third @react-email/render
• Align version-spec skew (docs @types/react(-dom), tailwind, gray-matter; workflow-renderer @types/hast); docs declares the remark-gfm/streamdown peers it consumes through @sim/workflow-renderer and drops unused jsdom
• lib/mcp/tool-validation.ts uses omit from @sim/utils/object instead of es-toolkit
• Shrink two ratchet baselines the bumps improved: knip 6.41 now sees updateUserUsageLimit through its aliased re-export, and @types/node 24.19 resolves a TS2724 in gateway.server.test.ts and a TS2322 in session-file-snapshot.test.ts

Held at the staging version after a per-package regression review (each needs its own PR):

• tiptap 3.31 / y-tiptap: pulls a second prosemirror-view/model copy — markdown round-trip and paste regressions, type errors
• react-query 5.104: stricter setQueryData updater types
• @anthropic-ai/sdk 0.133: ToolUnion shape change
• pi-ai / pi-coding-agent 1.1: sandbox image pin + model catalog drift (removes models)
• @modelcontextprotocol/sdk 1.32: client stops following cross-origin redirects
• @e2b/code-interpreter 2.8: needs e2b ≥2.55, above our override
• @daytona/sdk 0.224 (pins ws above our override) and OTel 0.222 with it
• streamdown 2.7: renders streamdown: placeholder images/links mid-stream
• mermaid 11.17: classDiagram renderer + spacing change
• @tanstack/react-virtual 3.14, @floating-ui/dom 1.8: rewritten scroll/clipping logic
• docx (committed sandbox bundle would drift from the worker), neo4j-driver 6.2 (UUID values), @azure/storage-blob (new default API version), redis 5.12, posthog-node 5.55, cronstrue 3.32 (copy changes), ipaddr.js 2.5, binary-extensions 3.2
• electron 43.7 / @playwright/test 1.64 / @electron/fuses 2: desktop e2e window-blur focus assertion fails; @clack/prompts 1.8: narrowed cancel type breaks sim-setup prompter.ts
• fumadocs (core/openapi version coupling), turbo 2.11 (Bun prune rewrite for the realtime image), @vercel/og 1 / opentype.js 2 (cover rendering), @types/busboy 1.5.5
• Not attempted: better-auth 1.7, stripe, biome 2.5, zod 4.6, next 16.4.2, drizzle-kit, trigger.dev 4.7, ioredis/redis 6, croner 10, js-yaml 5, jsdom 30, electron 44, undici 8, isolated-vm 7, pdfjs 6, monaco 0.57, Babel 8, officeparser 8, framer-motion 14, commander/chalk/lint-staged majors

Type of Change

• Chore (dependency maintenance)

Testing

• Per-package regression review of every bump: changelogs, old-vs-new tarball dist/.d.ts diffs, and our call sites; anything with a behavior change reaching our code was held back
• Lockfile rebuilt from staging's bun.lock so only changed specs re-resolve; no new duplicate copies of runtime packages
• pi-sandbox-packages.test.ts, pi-providers.test.ts, tool-validation.test.ts (20 passed), check:docs, biome on changed files
• Type-check, check:audits, test, build, e2e and integration run in CI

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing (new tests pass the test-audit authoring gate)
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 19, 2026 10:37pm UTC

[cubic-dev-ai]

No issues found across 29 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge based on the reviewed changes.

Summary

Updates dependencies across the workspaces, raises security override floors, and reduces duplicate package versions.

• Sim’s app and workspaces use refreshed dependency versions.
• Pinned dependency floors move to newer security and patch releases.
• EMCN resolves its UI packages at the same versions as the app.
• The docs site declares the packages it consumes through its renderer.
• MCP tool validation uses the shared object helper for omitted fields.
• The type-check and unused-export baselines record fewer known issues.
• Repository guidance now lives in a full AGENTS.md file.

_{Reviews (3) · Last reviewed commit: "chore(deps): hold desktop electron/playw..." · Reviewed by Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 32 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

[waleedlatif1]

@greptile

[waleedlatif1]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

[cubic-dev-ai]

No issues found across 32 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}